Remote Programming S7-1200 Over Internet: SCALANCE S623 VPN Setup

Remote engineering of an S7-1200 PLC (in this case CPU 1214C) over a public network requires a deliberate VPN architecture, correctly selected Siemens security modules, and proper TIA Portal V13 configuration. This reference walks through hardware selection, IP addressing, IPsec/OpenVPN tunneling, and verification using the SCALANCE S623 and the CP 1243-1 communications processor (often referenced in Siemens documentation as the "M873" module on the S7-1200 side).

1. Application Overview and Threat Model

A remote S7-1200 site is typically exposed to three risks: (a) unauthorized download/upload of the TIA Portal project, (b) interception of automation traffic (PROFINET, S7 communication), and (c) direct manipulation of I/O via the engineering channel. A point-to-point IPsec VPN between two SCALANCE S623 routers mitigates (a) and (b) because every TIA Portal packet is wrapped in ESP/AH and encrypted with AES-128/256.

Siemens explicitly recommends a SCALANCE S-class security appliance on both ends of the link for permanent remote-maintenance tunnels. This is documented in the application example SIEMENS Support Entry 99681360 - "SCALANCE S VPN: Configuration of secure connections". Ad-hoc solutions such as TeamViewer, while functional for desktop sharing, do not satisfy industrial-grade firewalling and segmentation; treat them only as a temporary fallback.

2. Hardware Bill of Materials

3. Network Architecture

The recommended topology is two isolated industrial LANs joined by an IPsec tunnel. Each SCALANCE S623 sits between the local DSL/cable/4G router and the PLC LAN. The PLC LAN (192.168.10.0/24 say) is never exposed on the WAN.

The TIA Portal PC sees the remote CPU as if it were on the local subnet 192.168.10.0/24 thanks to the routed tunnel.

4. IP Address Planning

Static vs Dynamic IP on the WAN side: A persistent IPsec tunnel requires that at least one endpoint have a stable public address. If the engineering site has a fixed public IP (recommended for the "server" side), the remote S623 can use a dynamic DNS name. If both ends are dynamic, switch to SINEMA Remote Connect (Siemens management server) or use a 4G router with a static APN.

5. SCALANCE S623 V3 Hardware Facts

Two identical SCALANCE S623 V3 units are sufficient for the architecture; they do not need to match firmware exactly, but a firmware mismatch can reduce the strongest available cipher. Update both to firmware V3.0 or later via the Siemens support downloads.

6. CP 1243-1 (M873) Configuration in TIA Portal V13

1. Open TIA Portal V13 with the project that targets the remote 1214C.
2. In the device tree, drag "CP 1243-1" onto the S7-1200 rack; the module occupies slot 1.
3. Open CP 1243-1 Properties → Ethernet addresses. Assign IP 192.168.10.20 / 255.255.255.0; the router field is left blank because the SCALANCE S623 at 192.168.10.1 does not route off-subnet.
4. Enable "Use router" only if the SCALANCE is on a different subnet. In the design above it is on the same subnet, so the CP's default gateway remains 192.168.10.1.
5. Activate "Security" → "Activate IPsec VPN". Choose "Connection to a SCALANCE S" and enter the remote S623's tunnel endpoint IP (e.g., 203.0.113.10).
6. Select authentication: Pre-Shared Key (PSK) is the simplest; for higher security use X.509 certificates loaded from the project tree.
7. Compile and download the configuration to the PLC locally before remote commissioning. Do not download over the WAN on first commissioning - the download service is open by default, which is an attack surface.

7. SCALANCE S623 VPN Configuration with Security Configuration Tool

The SCT (Security Configuration Tool) is the official Siemens method to define IPsec tunnels and push them to both S623 devices.

1. Install SCT from the Siemens support page on the engineering PC. Minimum version for SCALANCE S V3 is SCT V4.4 HF2 or newer.
2. Launch SCT and create a new project. Add both S623 appliances by their MAC address and IP.
3. Define the VPN connection: Mode = "Tunnel", Local = WAN IP of site B, Remote = WAN IP of site A, IKEv2, AES-256-CBC, SHA-256, DH group 14, lifetime 28800 s (8 h).
4. Generate a Pre-Shared Key of at least 32 random characters. Siemens recommends a passphrase >= 20 chars for AES-256.
5. Save the project. Use the "Import into device" wizard; the SCT packages both appliances' configuration files which must be loaded manually onto each S623 via its Web UI.
6. On each S623, log in via HTTPS (default credentials: admin / admin - change immediately), navigate to System → Load & Save → HTTP, and upload the .tgz generated by SCT.

8. Handling Dynamic IP Addresses

When the engineering site (which acts as the "hub") has a stable public IP, the remote S623 simply dials that IP. If the remote site is dynamic, the options are:

For a first deployment with limited budget, configure dynamic DNS on the remote S623, set short IKE lifetime (e.g., 1 h) so re-key tolerates IP changes, and pair with a watchdog timer that triggers the SCT to re-resolve the FQDN if the SA fails.

9. TIA Portal V13 Configuration for Remote Programming

1. Open the project. In "Online → Accessible nodes", wait up to 10 s; the remote CPU 1214C should appear with its LAN IP 192.168.10.10.
2. If the CPU does not appear, manually add the IP via "Online → Target device IP address" and click "Flash LED" to identify it.
3. Use "Project → Download to device" (Ctrl+B). TIA Portal will issue the AR (Application Relationship) establishment over the tunnel.
4. For first-time remote download, check the box "Online & diagnostics → Online access → Activate online functions for remote commissioning".
5. After download, force the CPU to RUN by setting "Operating mode switch → Start (Run)".

10. Security Hardening Checklist

• Change default passwords on both SCALANCE S623 devices (admin / admin). Use 12+ chars.
• Disable HTTPS if not used; otherwise limit to TLS 1.2/1.3 only.
• Set the SCALANCE firewall to "Stateful Inspection" and define explicit allow rules for TIA Portal (TCP 102) from the engineering subnet only.
• Enable syslog to a remote server (UDP 514 or TCP/SSL). The S623 supports TLS syslog.
• Enable NTP on both S623 devices; Siemens recommends time.siemens.com or a local NTP server.
• Use certificate-based IKEv2 instead of PSK if you operate more than three sites.
• Physically lock cabinets containing the SCALANCE devices - they expose management access.
• Set "Tunnel hold-down time" = 0 so re-key is immediate; "DPD" (Dead Peer Detection) = 30 s.

11. Verification Procedure

1. From the TIA Portal PC, ping 192.168.10.10 (CPU) and 192.168.10.20 (CP). Both should reply with sub-100 ms latency.
2. Open the S623 Web UI on the remote side (via https://192.168.10.1) and navigate to Information → VPN. Confirm Phase 2 SAs are present with matching SPI.
3. In TIA Portal: "Online → Online & diagnostics → Diagnostics status". Verify that the diagnostic buffer shows no "Connection interrupted" entries.
4. Perform a controlled stop/start of the S623 on the engineering side and observe the remote S623 syslog for "Tunnel re-established" messages.
5. Disconnect the WAN link at the remote site for 60 s. TIA Portal should display "connection lost" and recover automatically when WAN returns.

12. Troubleshooting Matrix

13. FAQ